A coding specialist in a group practice opens a neighbor’s electronic health record out of curiosity, with no assigned coding or billing duty for that patient. How should this access be classified?

Workforce members of a covered entity may access electronic protected health information only for assigned job duties. A coding specialist in a group practice who opens a neighbor’s EHR solely out of curiosity, with no coding or billing assignment for that patient, engages in unauthorized access. Employment at the same civic clinic does not create a personal browsing privilege. Classifying the look-up as unauthorized access correctly aligns HIPAA privacy expectations with role-based access controls that protect public trust in community physician practices.

Calling the access permitted personal use because the employee works for the same covered entity fails by concept because workforce status authorizes role-based access, not recreational chart surfing. Labeling it an allowable quality-review look-back without a job-related purpose fails because quality activities still require a legitimate assigned purpose and process, not unilateral curiosity. Treating the access as acceptable merely because nothing was edited or printed fails because unauthorized viewing is still an impermissible access; alteration is not the sole privacy harm.

Exam caveat: sanctioned audit, compliance, or quality reviews conducted under policy with a defined purpose differ from idle neighbor lookups; the distinction is assigned purpose and authorization, not whether the reader works in HIM. Operational check: reinforce that each EHR open should map to an assigned coding, billing, audit, or care task; escalate and document snooping per sanction policy; and use access logs in civic practices to verify professional-fee staff are not browsing unrelated charts.